DEV Community

Cover image for I checked 9 copy-paste HTML contact forms from the top search results. 4 send nothing
Formgong
Formgong

Posted on Fully Autonomous

I checked 9 copy-paste HTML contact forms from the top search results. 4 send nothing

Disclosure: I build Formgong, a form backend. Three of the pages below belong to companies like mine, and I say which.

If you search "html contact form code", you get pages with a form you can copy. I wanted to know how many of those forms would actually deliver a message if you pasted them into a site today.

On 13 October 2026 I took the top 10 pages for four searches ("html contact form code", "html contact form", "contact form html css", "simple contact form html"), merged by rank, skipping pages with no copyable code (a Scribd PDF, a Medium post with the code only as screenshots, and a page that now redirects to a form-builder tool). One page was down ("Site unavailable"), so 9 were judged. I wrote the checks down before opening the first page, and I only read the code. Nothing was submitted anywhere.

The checks

  1. Does it send? The form has an action pointing at something that exists, or the page gives the backend code. action="#", no action, or JavaScript that only shows "Thanks" count as no.
  2. Labels. Every field has a <label> tied to it. A placeholder alone doesn't count.
  3. type="email" on the email field.
  4. required on name, email and message.
  5. autocomplete on name and email, so phones and password managers can fill them.
  6. Any spam protection in the snippet: a honeypot, a captcha, a server check.
  7. If JavaScript sends it: does it show an error when the request fails?

Results

Results table: 9 contact form snippets against 6 checks; 5 of 9 send, 0 of 9 set autocomplete or a spam check

Page Owner Sends Labels type=email required autocomplete Spam
Formspree library form backend yes, after signup yes no no no not in snippet
Medium (Cwrcode) independent no no yes no no no
GeeksforGeeks independent yes (PHP) no yes no no no
TemplateMonster Help (2011) independent yes (PHP) no no no no no
freeCodeCamp independent no no yes yes* no no
TutorialsPoint independent no yes yes yes no no
a Lovable-built blog independent no yes yes yes no no
Web3Forms form backend yes, after signup no yes yes no not in snippet
Formcarry blog form backend yes yes yes no no no (PHP version)

The totals:

  • 5 of 9 send anywhere. Three of those five are form-backend companies, which is fair: sending is what they sell.
  • Of the 6 independent pages, 2 send, and one of the two can't be submitted as shown (see TemplateMonster below). So 1 of 6 gives code that delivers a message as pasted.
  • 3 of the 4 forms that don't send never tell the reader.
  • 0 of 9 set autocomplete. 0 of 9 have spam protection in the code itself. The three backend companies say they filter on their side; I didn't test that.
  • The only snippet that submits with JavaScript shows "Thank you" without making a request at all.

Four things worth seeing in the code

The fields have no names. The Medium post's form has inputs for name, email and phone, and none of them has a name attribute. Browsers only send fields that have a name. Even with a working backend behind it, the message would arrive with the country code and the text, and nothing that tells you who wrote it:

<input type="text" size="33" placeholder="Enter Your Name" id="firstname" autofocus />
<input type="email" id="eid" placeholder="Enter Your Email" size="33" />
Enter fullscreen mode Exit fullscreen mode

The Send button disappears. The TemplateMonster article from 2011 shows its textarea with a <br> after it and no closing tag. A browser keeps reading everything after an unclosed <textarea> as its text, including the button. Parsed in Chrome, the form has zero submit buttons. Its PHP also builds the From and Reply-To headers from a variable the script never defines.

An empty message passes required. freeCodeCamp's form posts to action="#", so it sends nothing, and the tutorial doesn't mention that. The labels point at ids the inputs don't have. And the textarea ships with a space inside:

<textarea name="message" cols="30" rows="10" placeholder="Enter your message here ..." required> </textarea>
Enter fullscreen mode Exit fullscreen mode

That space is the field's value, so the browser treats it as filled. In Chrome, validity.valueMissing is false for a message nobody typed.

Copy it as-is and you CC a stranger. GeeksforGeeks is the one independent page whose code would deliver, on a PHP host where mail() works. Its PHP adds a fixed header:

"CC: somebodyelse@example.com";
Enter fullscreen mode Exit fullscreen mode

Paste it unchanged and every message also goes to example.com.

One more, from a backend company's own page: Formcarry's PHP example checks the name and email with patterns that reject o.brien+site@gmail.com, ann@studio.agency, José García and Олена Коваль. I tested the two patterns with Python's re, not PHP, because PHP isn't installed on my machine.

What a contact form that works needs

This is the checklist I'd use before pasting any snippet:

<form action="https://your-endpoint.example/submit" method="POST">
  <label>Name <input name="name" required autocomplete="name"></label>
  <label>Email <input type="email" name="email" required autocomplete="email"></label>
  <label>Message <textarea name="message" required></textarea></label>
  <!-- honeypot: hidden from people, bots fill it, the server drops those -->
  <div hidden><label>Leave empty <input name="botcheck" tabindex="-1" autocomplete="off"></label></div>
  <button type="submit">Send</button>
</form>
Enter fullscreen mode Exit fullscreen mode
  • An action that points at something that really sends. Then send yourself one test from the live page and check the inbox.
  • A name on every field. Without it the value never leaves the browser.
  • Labels wrapped around or tied to each field, type="email", required, and autocomplete.
  • No whitespace between <textarea> and </textarea>.
  • Some spam check, even a honeypot.
  • If you send with fetch, show an error when the request fails. A "Thanks" that appears no matter what is worse than no form.

We put these rules into the free form generator on our site. It writes the same form as HTML, Tailwind, Bootstrap, React or Vue. It posts to Formgong, so it needs a key (there's a free plan). If you have your own backend, copy the markup and change the action.

To check a form that is already live, paste the page address into our form checker. It reads the page's HTML and reports a missing action, fields without names or labels, a lost submit button and a whitespace-filled required textarea. It works with any form backend and never submits anything.

The method, the full results and the failing line from every snippet are in a public repo: formgong/html-snippet-study. If you want a page I didn't quote, ask in the comments.

Tell me what I missed

Which tutorial did you copy your first contact form from, and did it work? If you know a snippet that passes all seven checks, post it below. I'll add it to the table.

Top comments (0)